Product and intended use
Define the configuration, people, information and tasks being assessed.
Product and plan covered
Public claim only
The Data Processing Terms v1.2 (10 June 2026) define the Purpose of the Platform as 'an aid to the production of: (1) medical records summaries; (2) expert reports; (3) indexed and paginated bundles; and (4) chronologies, in each case, for use in legal proceedings' (paragraph 2.4). The vendor's navigation groups two named products under 'Medical AI' - 'Medical Summaries' and 'Indexed & paginated bundles' - and this profile covers the Medical Summaries product page only; the bundle indexing page was not opened. The product page publishes eight named summary sections: Patient Details, Incident Confirmation, Medical Presentations, Pre-existing Conditions, Symptom Timeline, Diagnosis & Treatment, Comprehensive Citations and Follow-up.
Ask: Does our order cover Medical Summaries only, or also indexed and paginated bundles, chronologies and expert reports, and which document in the Legal & Fees Pages suite sets the scope of what we have bought?
Deployment model and where the platform runs
Public claim only
The Data Processing Terms state at paragraph 4.5.1 that 'the Platform is hosted on Amazon Web Services' and that 'The Supplier utilises AWS region, availability zone and account-isolation features to support data residency, segregation and resilience'. Paragraph 3.9 fixes the locations: data hosted at rest in the United Kingdom (AWS eu-west-2, London) and inference within the AWS European geographic deployment covering the United Kingdom and the European Economic Area. Access is through regional dashboards for the United Kingdom, United States and Australia (paragraph 4.4.1). No private cloud, on-premises or self-hosted option is published.
Ask: Given paragraph 3.9 fixes storage in AWS eu-west-2 and inference in the AWS European deployment, is any Australian region available to us, and if not what does the Australian dashboard actually change?
What the service produces and what is claimed for it
Public claim only
The product page, checked 2026-09-27, states 'Our AI reads, interprets and structures the records, extracting diagnoses, treatments and timelines, with page-level citations back to the source records', publishes a turnaround of '5 min - 1 hr Turnaround for most bundles' and a volume figure of '2,500+ pages Per processing run', and describes a three-step workflow of Upload, 'AI processes your records' and 'Receive your summary'. These are marketing statements; the Platform Specification v1.1 listed on the Legal & Fees Pages index, which would state the contractual specification, was not opened.
Ask: Does the Platform Specification warrant the published turnaround and the 2,500-page-per-run figure, and what happens to the fee if a bundle exceeds it?
Governing law and jurisdictional fit for Australian work
Public claim only
The Data Processing Terms are drafted to United Kingdom and European Union data protection law: Data Protection Legislation is defined as the Data Protection Act 2018, the EU GDPR, the UK GDPR and the Privacy and Electronic Communications (EC Directive) Regulations 2000, with no reference to the Privacy Act 1988 or the Australian Privacy Principles. The Legal & Fees Pages index lists a 'Regional Variance Addendum (Australia)' as 'Pending' with no version or date, checked 2026-09-27. The published summary template names United Kingdom record fields, including 'NHS or reference numbers'.
Ask: Until the Australian Regional Variance Addendum is published, which document addresses APP 8 cross-border disclosure and APP 11 security for our Australian claimant records, and what is the expected publication date?
Check for vendor content directing how AI describes the product
Not confirmed
A deliberate check for content telling AI models, assistants or crawlers how to describe the product found none on this vendor's site as at 2026-09-27. Checked: a site map run with a 60-URL limit, which returned no /llms.txt, /ai-info, /ai or /for-ai path; the full link sets and footers of four pages read (the Medical Summaries product page, the Legal & Fees Pages index, the Data Processing Terms and the website privacy policy), which contain no such path; and the text of those pages, which contains no block addressed to AI models, assistants or LLMs. No file at /llms.txt was fetched directly, so this is an absence in what was indexed and read rather than a proven absence. The product page does carry a vendor uniqueness heading, 'Unique to FinLegal', which is marketing framing and is not carried into this profile.
Ask: Does FinLegal publish any file or page addressed to AI models or crawlers, such as /llms.txt, describing how the product should be presented?
Data, controls and requirements
Compare the actual configuration with firm, client and jurisdiction requirements, supported by evidence.
Authority to put client medical records into the service
Public claim only
The Data Processing Terms make the customer the controller and the supplier the processor (paragraph 2.1), and require the customer to ensure 'that all consents and notices are in place to enable the lawful transfer of the Customer's Personal Data to the Supplier and, in particular, the conditions under the Data Protection Legislation for processing special category data have been met' (paragraph 2.2.2). Paragraph 2.3 records the parties' expectation that the grounds for processing special category data are 'explicit consent obtained by the Customer' or 'the conduct of legal claims or judicial acts'. The obligation is expressed against United Kingdom and European legislation only.
Ask: For an Australian file, does FinLegal accept that the paragraph 2.2.2 warranty is satisfied by Privacy Act 1988 consent and APP 8 steps rather than GDPR consent, and will that be recorded in writing before we upload?
Which models and model providers process the records
Public claim only
The Data Processing Terms paragraph 3.9 names the inference platform: 'AI inference is performed within the AWS European geographic deployment ("EU GEO") ... in each case under Amazon Bedrock zero-retention terms.' Paragraph 4.5.1 states the Platform is hosted on Amazon Web Services. No individual foundation model, model family or model version is named anywhere on the pages read, and the Sub-processor List v1.1, which may name further providers, was not opened.
Ask: Which specific models on Amazon Bedrock generate the summary, who publishes each of them, and will we be told before a model is changed?
Sub-processors and the right to object
Public claim only
A Sub-processor List is published as part of the contract suite at finlegal.ai/terms/sub-processor-list, version 2026-06-10 v1.1 per the Legal & Fees Pages index; it was not opened. The Data Processing Terms give general authorisation to appoint sub-processors (paragraph 3.2), require equivalent contractual obligations on them (paragraph 3.3), and require notice before a New Sub-processor with ten days for the customer to object on reasonable grounds, failing which 'The Customer's failure to object in writing within such time period shall constitute approval' (paragraph 3.5). Paragraph 3.6 states that an inability to use a sub-processor 'may result in a delay or suspension in the performance of the Platform Services, inability to perform the Platform Services or increased Fees', and paragraph 3.7 makes a resulting customer termination 'a termination for convenience and not for breach'.
Ask: Who is on the current Sub-processor List for Medical AI, in which countries do they operate, and how is the ten-day objection notice delivered to us so it is not missed?
Whether customer records are used to train or improve models
Not confirmed
The Data Processing Terms limit processing to the customer's documented instructions and the Purpose of the Platform (paragraph 3.1.2) and state that inference runs 'under Amazon Bedrock zero-retention terms' (paragraph 3.9), but they contain no express prohibition on the supplier using customer content to train, fine-tune or improve models, and no clause addresses model improvement at all. The AI Acceptable Use Policy dated 2026-06-03, which is listed in the contract suite, was not opened. The product page and the website privacy policy say nothing on the point; the privacy policy expressly states it 'does not apply to personal data that we process on behalf of customers who use our platform services'.
Ask: Will FinLegal warrant in the order that neither it nor any sub-processor uses our uploaded records, prompts or outputs to train, fine-tune or evaluate any model, and is that stated in the AI Acceptable Use Policy?
Use of prompts, corrections and output feedback
Not confirmed
Nothing on the pages read addresses what happens to corrections, ratings or other feedback a reviewer gives on a generated summary. The Data Processing Terms treat all material submitted to the Platform, including Prompts, as the Customer's Personal Data where it is personal data (paragraph 1.2) and restrict processing to documented instructions and the Purpose of the Platform, but there is no separate feedback or telemetry clause. The AI Acceptable Use Policy was not opened.
Ask: If a reviewer corrects a generated summary in the platform, is that correction retained, reviewed by FinLegal staff, or used for any purpose beyond producing our document?
How long records and outputs are kept
Not confirmed
The Data Processing Terms set no retention period for customer data. Deletion is on request only (paragraph 3.1.7) and the duration of the processing is stated simply as 'The duration of the Platform Services' (paragraph 3.12.2). Paragraph 3.9 states inference runs under 'Amazon Bedrock zero-retention terms', which addresses the inference provider rather than the platform's own storage. Paragraph 4.3.11 describes encrypted backups with periodic restoration testing but gives no backup retention period. The firm therefore has to set the retention position itself in the order.
Ask: What retention period applies to uploaded bundles, generated summaries and backups if we make no request, and can a shorter automatic deletion period be written into our order?
Deletion and return of data
Public claim only
The Data Processing Terms require the supplier, 'at the Customer's written request, [to] return or delete the Customer's Personal Data and delete any existing copies of such Customer's Personal Data in its possession unless required to retain such Customer's Personal Data under applicable laws' (paragraph 3.1.7). No timeframe for completing the deletion, no certificate of destruction and no treatment of encrypted backups on deletion are published.
Ask: Within how many days of a written deletion request are bundles, summaries and backups destroyed, and will FinLegal certify the destruction?
Which people can read uploaded medical records
Public claim only
The Data Processing Terms state that 'access to the production environment (including production databases) is restricted to authorised members of the Supplier's operations and engineering teams on a least-privilege, role-based basis' (paragraph 4.2.1), that 'production Customer's Personal Data is not copied to, or used within, the Supplier's development, test or staging environments' (paragraph 4.2.2), that access rights are revoked within one business day on termination or role change (paragraph 4.2.3), that access rights are reviewed at least every six months (paragraph 4.2.4), and that administrative access requires multi-factor authentication (paragraph 4.2.5). Paragraph 3.1.4 requires representatives and sub-processors to be under confidentiality obligations. The countries from which staff access production are not stated, and no customer-visible log of supplier access is published.
Ask: From which countries can operations and engineering staff access production data containing our clients' medical records, and can we obtain a log of any such access on a matter?
How user accounts are authenticated, and the default
Not confirmed
The Data Processing Terms set the authentication default at paragraph 4.4.4: 'for all regions: access via magic link (one tap/click to authenticate from email or SMS) unless expressly requested to be deactivated by the Customer in writing to the Supplier; and email address and password authentication where expressly requested to be activated by the Customer in writing to the Supplier.' Federated single sign-on including SAML 2.0 and OIDC, and multi-factor authentication, are supported 'where the Customer requires it' (paragraphs 4.4.1.2 and 4.4.3). Password complexity, session timeout and lockout thresholds are stated to align with NCSC and NIST guidance (paragraph 4.4.2).
Ask: Will FinLegal deactivate magic-link authentication and enable single sign-on with multi-factor authentication for our tenancy before any records are uploaded, and what written form does that request have to take?
Encryption at rest and in transit
Public claim only
The Data Processing Terms require 'encryption of Customer's Personal Data at rest using AES-256 or stronger' (paragraph 4.3.7), 'encryption of Customer's Personal Data in transit using TLS 1.2 or higher' (paragraph 4.3.8) and 'encrypted backups of Customer's Personal Data' (paragraph 4.3.11). Key management, key custody and whether the customer can hold its own keys are not addressed.
Ask: Who holds and rotates the encryption keys for our data at rest, and is a customer-managed key option available?
Independent assurance over the platform
Public claim only
The product page carries an unlinked badge row reading 'SOC 2 compliantUK GDPR compliantData encrypted at restFine-grained user management' and a statistic tile reading 'UK GDPR - SOC 2 Records encrypted at rest', checked 2026-09-27. No SOC 2 report, scope statement, audit period, auditor or certificate is published, and no trust centre or security page was found on the site. The Data Processing Terms' Security Controls describe 'penetration testing of the Platform by an independent third party at least annually' (paragraph 4.3.1) and a documented vulnerability management programme (paragraph 4.3.2) but name no certification or attestation.
Ask: Can we see the SOC 2 report, its type, period and scope, and confirm whether the Medical AI platform is inside that scope?
What documents form the agreement
Public claim only
The Legal & Fees Pages index, checked 2026-09-27, describes itself as 'The suite of documents that form the Agreement when a customer enters into a paid Order for the Platform Services' and states 'Each document is published with versioned URLs so the exact bytes a customer agreed to remain addressable for the life of their account.' It lists Platform General Terms and Conditions (2026-06-03), Platform Specification (2026-06-10 v1.1), Support Specification (2026-06-25), Data Processing Terms (2026-06-10 v1.2), AI Acceptable Use Policy (2026-06-03), Fees Policy (2026-06-03) and Sub-processor List (2026-06-10 v1.1), plus Regional Variance Addenda for the United States, South Africa and Australia all marked 'Pending'. Only the Data Processing Terms were opened. Neither the index nor the Data Processing Terms names the contracting entity; the footer and website privacy policy name Litigationware Ltd.
Ask: Which legal entity will be named as Supplier on our Order, under which governing law and jurisdiction, and will the Australian Regional Variance Addendum apply to us when it is published?
Cross-border transfer of the records
Public claim only
The Data Processing Terms state at paragraph 3.8 that 'the Customer's Personal Data may be processed outside the UK, the European Economic Area, or the country where the Customer is located in order to carry out the Platform Services', with the supplier to implement a transfer solution. Paragraph 3.9 fixes the locations: storage at rest in the United Kingdom (AWS eu-west-2, London) and inference in the AWS European geographic deployment covering the United Kingdom and the European Economic Area, with United Kingdom to European Economic Area transfers made 'in reliance on the United Kingdom's adequacy regulations in respect of EEA member states'. For an Australian customer this is an outbound transfer of health information to the United Kingdom and Europe; no Australian Privacy Principle 8 mechanism is identified in the document.
Ask: What mechanism does FinLegal rely on for the APP 8 cross-border disclosure of Australian health information to the United Kingdom and the European Economic Area, and will it accept contractual APP 8 obligations?
Data breach notification
Public claim only
The Data Processing Terms require the supplier to 'notify the Customer without undue delay on becoming aware of a personal data breach involving the Customer's Personal Data' (paragraph 3.1.6), and to give reasonable assistance with data breach notification 'insofar as this is possible and at the Customer's cost' (paragraph 3.1.5). No fixed hour count, no content requirements for the notice and no reference to the Australian Notifiable Data Breaches scheme are published.
Ask: Will FinLegal commit to a fixed notification period in hours and to the information we need for a Notifiable Data Breaches assessment, and who bears the cost of that assistance?
How changes to the service and the documents are notified
Public claim only
The Legal & Fees Pages index states that 'Each document is published with versioned URLs so the exact bytes a customer agreed to remain addressable for the life of their account', and carries a version and publication date against each document, checked 2026-09-27. The Data Processing Terms require notice before adding a New Sub-processor (paragraph 3.5), written notice of any change to the Platform Services or Fees arising from an objection (paragraph 3.7), and that 'infrastructure changes to production are managed through version-controlled, peer-reviewed change processes' (paragraph 4.5.5). No commitment to notify customers of changes to the models, the summary template or the claim types supported is published; the product page says claim types are added 'every quarter'.
Ask: How will we be told when the model, the summary template or the supported claim types change, and can we stay on an agreed version of the Platform Specification?
Getting data and outputs out at the end
Not confirmed
The only exit provision found is the return-or-delete obligation on written request in the Data Processing Terms paragraph 3.1.7. Paragraph 3.7 provides that a customer terminating because of an unacceptable New Sub-processor is treated as terminating for convenience. No export format, no transition assistance, no post-termination access window and no run-off period are published; the Platform General Terms and Conditions were not opened.
Ask: On termination, in what format and over what period can we export uploaded bundles, generated summaries and audit records, and is any transition assistance included?
Integrations with firm systems
Not confirmed
No integration list, API documentation or connector catalogue was found. The published intake is manual: 'Upload medical records as PDF through the FinLegal platform', checked 2026-09-27. The only integration point in the Data Processing Terms is federated single sign-on, 'including SAML 2.0 and OIDC', where the customer requires it (paragraph 4.4.3). Whether records can be sent from a practice management or document management system, and whether outputs can be written back, is not published.
Ask: Is there an API or connector that lets us send records from our document management system and return the summary to the matter file, or is manual PDF upload and download the only path?
Whether the service reaches outside the uploaded records
Not confirmed
Nothing on the pages read states whether the model may consult sources beyond the records uploaded for the matter. The product page describes the output as cited entirely to the bundle - 'every finding is cited back to the underlying medical evidence with page-level references' - and the Data Processing Terms describe inference confined to the AWS European geographic deployment (paragraph 3.9), but neither document says that external retrieval or web access is excluded.
Ask: Can the summarisation step retrieve anything from outside the uploaded bundle, for example clinical reference material or web content, and can that be disabled for our account?
Whether the service takes actions on its own
Not confirmed
The published workflow is three steps - upload records, 'AI processes your records', receive the summary - with no action taken outside producing the document, and the Data Processing Terms describe the Platform as 'an aid to the production of' the four named output types (paragraph 2.4). Neither document states what the service may or may not do autonomously, and no agent, task automation or outbound messaging capability is published for Medical AI.
Ask: Does any part of Medical AI act outside generating the requested document, for example sending, filing or amending anything, and is there an administrator control over that?
Human review of the generated summary
Public claim only
The Data Processing Terms describe the Platform as 'an aid to the production of: (1) medical records summaries; (2) expert reports; (3) indexed and paginated bundles; and (4) chronologies, in each case, for use in legal proceedings' (paragraph 2.4). The product page's three-step workflow contains no review step by the vendor, and the page states outputs are 'ready to use immediately in case preparation and settlement negotiations' while also describing the citation feature as enabling reviewers to 'verify each statement against its source in seconds'. No reviewer sign-off is offered and none is excluded, and no accuracy measure is published.
Ask: Is any human check performed by FinLegal before a summary is delivered, and what does FinLegal say about the accuracy rate of extraction for the claim types we run?
